wakeup from S3, windows 8 enter BSOD

C

caroatemc

New Member
Messages
1
Like the title say, windows 8 BSOD after wake up from S3. The following is the dumpfile ( Sorry, I did not have dump file now.) I just Wonder the meaning of the "AV"
BUGCHECK_STR: AV
PROCESS_NAME: System

The dump file show the possible root cause is HIDCLASS.sys. Could someone explain the detail of fail reason? How to solve the problem?

Microsoft (R) Windows Debugger Version 6.2.9200.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.

Loading Dump File [E:\MEMORY.DMP]
Kernel Bitmap Dump File: Full address space is available
Symbol search path is: SRV*D:\WinDebug\SRV*http://msdl.microsoft.com/download/symbols
Executable search path is:
Windows 8 Kernel Version 9200 MP (4 procs) Free x64
Product: WinNt, suite: TerminalServer SingleUserTS
Built by: 9200.16461.amd64fre.win8_gdr.121119-1606
Machine Name:
Kernel base = 0xfffff803`86c14000 PsLoadedModuleList = 0xfffff803`86edea80
Debug session time: Wed Apr 24 08:17:28.072 2013 (UTC + 8:00)
System Uptime: 0 days 21:31:04.173
Loading Kernel Symbols
...............................................................
................................................................
.....................................................
Loading User Symbols
Loading unloaded module list
............
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
Use !analyze -v to get detailed debugging information.
BugCheck 50, {fffffffffffffff7, 0, fffff80386cedcfb, 0}
Probably caused by : HIDCLASS.SYS ( HIDCLASS!HidpIdleTimeWorker+6d )
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffffffff7, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80386cedcfb, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

READ_ADDRESS: fffffffffffffff7
FAULTING_IP:
nt!IoReuseIrp+2b
fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h]
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff8801aa37880 -- (.trap 0xfffff8801aa37880)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff6c9a15d4b110 rbx=0000000000000000 rcx=ffffffffffffffb0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80386cedcfb rsp=fffff8801aa37a10 rbp=fffffa800bc80440
r8=0000000000000000 r9=0000000000000000 r10=0000000000000062
r11=fffff8801aa37aa8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!IoReuseIrp+0x2b:
fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h] ds:ffffffff`fffffff7=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80386dfcbe1 to fffff80386c8f340
STACK_TEXT:
fffff880`1aa37698 fffff803`86dfcbe1 : 00000000`00000050 ffffffff`fffffff7 00000000`00000000 fffff880`1aa37880 : nt!KeBugCheckEx
fffff880`1aa376a0 fffff803`86cc9cef : 00000000`00000000 ffffffff`fffffff7 fffffa80`0e895040 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x32321
fffff880`1aa37740 fffff803`86c8cdee : 00000000`00000000 fffff880`05666440 00000000`00000000 fffff880`1aa37880 : nt!MmAccessFault+0x54f
fffff880`1aa37880 fffff803`86cedcfb : 45ad6cbf`00000001 00000000`00000000 00000000`00000003 fffff803`86cba1bb : nt!KiPageFault+0x16e
fffff880`1aa37a10 fffff880`05664e69 : 00000000`00000000 fffff880`05666440 fffffa80`0bc80440 ffffffff`ffffffb0 : nt!IoReuseIrp+0x2b
fffff880`1aa37ab0 fffff803`86c7a413 : fffffa80`0bd35930 00000000`00000000 fffff880`05664dfc fffffa80`0bc80440 : HIDCLASS!HidpIdleTimeWorker+0x6d
fffff880`1aa37b10 fffff803`86cc7511 : fffff803`86e98110 fffffa80`0e895040 fffff803`86c7a3b4 fffff803`86eabd00 : nt!IopProcessWorkItem+0x5f
fffff880`1aa37b80 fffff803`86c36551 : fffffa80`06712810 00000000`00000080 fffff803`86cc73d0 fffffa80`0e895040 : nt!ExpWorkerThread+0x142
fffff880`1aa37c10 fffff803`86c74dd6 : fffff803`86f0a180 fffffa80`0e895040 fffffa80`071efb00 fffffa80`0671b940 : nt!PspSystemThreadStartup+0x59
fffff880`1aa37c60 00000000`00000000 : fffff880`1aa38000 fffff880`1aa32000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb
FOLLOWUP_IP:
HIDCLASS!HidpIdleTimeWorker+6d
fffff880`05664e69 4885f6 test rsi,rsi
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: HIDCLASS!HidpIdleTimeWorker+6d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: HIDCLASS
IMAGE_NAME: HIDCLASS.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 50ab0d6a
BUCKET_ID_FUNC_OFFSET: 6d
FAILURE_BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
Followup: MachineOwner
---------
1: kd> !analyze -v
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffffffffffffff7, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff80386cedcfb, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000000, (reserved)
Debugging Details:
------------------

READ_ADDRESS: fffffffffffffff7
FAULTING_IP:
nt!IoReuseIrp+2b
fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h]
MM_INTERNAL_CODE: 0
DEFAULT_BUCKET_ID: WIN8_DRIVER_FAULT
BUGCHECK_STR: AV
PROCESS_NAME: System
CURRENT_IRQL: 0
TRAP_FRAME: fffff8801aa37880 -- (.trap 0xfffff8801aa37880)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=ffff6c9a15d4b110 rbx=0000000000000000 rcx=ffffffffffffffb0
rdx=0000000000000000 rsi=0000000000000000 rdi=0000000000000000
rip=fffff80386cedcfb rsp=fffff8801aa37a10 rbp=fffffa800bc80440
r8=0000000000000000 r9=0000000000000000 r10=0000000000000062
r11=fffff8801aa37aa8 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
nt!IoReuseIrp+0x2b:
fffff803`86cedcfb 0fb67147 movzx esi,byte ptr [rcx+47h] ds:ffffffff`fffffff7=??
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80386dfcbe1 to fffff80386c8f340
STACK_TEXT:
fffff880`1aa37698 fffff803`86dfcbe1 : 00000000`00000050 ffffffff`fffffff7 00000000`00000000 fffff880`1aa37880 : nt!KeBugCheckEx
fffff880`1aa376a0 fffff803`86cc9cef : 00000000`00000000 ffffffff`fffffff7 fffffa80`0e895040 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x32321
fffff880`1aa37740 fffff803`86c8cdee : 00000000`00000000 fffff880`05666440 00000000`00000000 fffff880`1aa37880 : nt!MmAccessFault+0x54f
fffff880`1aa37880 fffff803`86cedcfb : 45ad6cbf`00000001 00000000`00000000 00000000`00000003 fffff803`86cba1bb : nt!KiPageFault+0x16e
fffff880`1aa37a10 fffff880`05664e69 : 00000000`00000000 fffff880`05666440 fffffa80`0bc80440 ffffffff`ffffffb0 : nt!IoReuseIrp+0x2b
fffff880`1aa37ab0 fffff803`86c7a413 : fffffa80`0bd35930 00000000`00000000 fffff880`05664dfc fffffa80`0bc80440 : HIDCLASS!HidpIdleTimeWorker+0x6d
fffff880`1aa37b10 fffff803`86cc7511 : fffff803`86e98110 fffffa80`0e895040 fffff803`86c7a3b4 fffff803`86eabd00 : nt!IopProcessWorkItem+0x5f
fffff880`1aa37b80 fffff803`86c36551 : fffffa80`06712810 00000000`00000080 fffff803`86cc73d0 fffffa80`0e895040 : nt!ExpWorkerThread+0x142
fffff880`1aa37c10 fffff803`86c74dd6 : fffff803`86f0a180 fffffa80`0e895040 fffffa80`071efb00 fffffa80`0671b940 : nt!PspSystemThreadStartup+0x59
fffff880`1aa37c60 00000000`00000000 : fffff880`1aa38000 fffff880`1aa32000 00000000`00000000 00000000`00000000 : nt!KiStartSystemThread+0x16

STACK_COMMAND: kb
FOLLOWUP_IP:
HIDCLASS!HidpIdleTimeWorker+6d
fffff880`05664e69 4885f6 test rsi,rsi
SYMBOL_STACK_INDEX: 5
SYMBOL_NAME: HIDCLASS!HidpIdleTimeWorker+6d
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: HIDCLASS
IMAGE_NAME: HIDCLASS.SYS
DEBUG_FLR_IMAGE_TIMESTAMP: 50ab0d6a
BUCKET_ID_FUNC_OFFSET: 6d
FAILURE_BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
BUCKET_ID: AV_HIDCLASS!HidpIdleTimeWorker
Followup: MachineOwner
---------
1: kd> lmvm HIDCLASS
start end module name
fffff880`05658000 fffff880`05673000 HIDCLASS (pdb symbols) d:\windebug\srv\hidclass.pdb\CEC5F9DA80B2429B8D741A9437FAED8A2\hidclass.pdb
Loaded symbol image file: HIDCLASS.SYS
Image path: \SystemRoot\System32\drivers\HIDCLASS.SYS
Image name: HIDCLASS.SYS
Timestamp: Tue Nov 20 12:56:10 2012 (50AB0D6A)
CheckSum: 00016912
ImageSize: 0001B000
File version: 6.2.9200.16461
Product version: 6.2.9200.16461
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 2.0 Dll
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft? Windows? Operating System
InternalName: hidclass.sys
OriginalFilename: hidclass.sys
ProductVersion: 6.2.9200.16461
FileVersion: 6.2.9200.16461 (win8_gdr.121119-1606)
FileDescription: Hid Class Library
LegalCopyright: ? Microsoft Corporation. All rights reserved.
Click to expand...


Thanks first.
 

My Computer

System One

  • OS
    windows 8
I'm uncertain what the BUGCHECK_STR: AV means. I'd guess that it stands for "Access Violation" - but that's not applicable (AFAIK) in a STOP 0x133 error

The PROCESS_NAME: System is merely the process that the thread was executing in when the crash occurred. Most references will say that this doesn't matter in debugging a crash - but I find that if it's repeatedly the same process (and not a Windows process), then it might be significant.

As for the analysis, it's not simply a matter of what's listed as the cause. The cause occurs where the crash occurs - but take this for example:

A driver (call it xyz.sys) writes to memory space owned by the HIDCLASS.sys driver
Then the xyz.sys driver exits - and no trace of it remains on the system
Then HIDCLASS.sys attempts to access that memory space - and finds the wrong info there.
At that point it "panics" and crashes the system.
So, the cause is listed as HIDCLASS.sys - but the real culprit is xyz.sys (which is nowhere to be found).

Then comes the detective work!
First, we assume that 90+% of BSOD's are caused by 3rd party (non-Windows) drivers
Then, we assume that the majority of the remainder are due to hardware issues/failures
Finally, we assume that a small percentage (less than 1% IME) are due to Windows problems.

In many BSOD's we find that Windows drivers are blamed (like HIDCLASS.sys is blamed here). The thought process we use here is that Windows has protection mechanisms built into it to protect the drivers, so they're (Windows drivers) are the least likely to be corrupted/damaged/problematic. Also, if the are damaged, you're more likely to see other problems in addition to the occasional BSOD. So we conclude that a Windows driver blamed in the memory dumps isn't the real reason.

Luckily (IMO) this is a BugCheck 50 - PAGE_FAULT_IN_NONPAGED_AREA - which is usually amenable to manipulation using Driver Verifier. This will help us (we hope) to isolate the name of the actual offending driver. Follow the instructions here to stress the 3rd party drivers: Driver Verifier Settings

There are other things that we do, but we need the actual memory dumps and other reports to see what's going on inside the system. Please provide this information so we can provide a complete analysis: http://www.eightforums.com/bsod-cra...e-screen-death-bsod-posting-instructions.html
 

My Computer

System One

  • OS
    Win8.1Pro - Finally!!!
    Computer type
    Laptop
    System Manufacturer/Model
    Samsung/NP780
    CPU
    Came with the laptop (i7 of some sort)
    Motherboard
    Pretty sure that it has one, but haven't checked inside the case!
    Memory
    upgraded to 12 gB from 8 gB
    Graphics Card(s)
    has switchable - Intel/ATI - Used wrong drivers, now ATI card is inop :( Will have to fix it soon!
    Sound Card
    I'm nearly deaf, so this isn't used often
    Monitor(s) Displays
    Touchscreen on laptop/32" Toshiba on HDMI (laid the Sharp TV on a mouse and cracked the screen!)
    Screen Resolution
    800x600
    Hard Drives
    One Samsung 1tB drive - 5400 rpm. Gonna switch to a 7200/10000 rpm or an SSD (if I can find $500 for a 1tB SSD!)
    - Switched to 500 gB Samsung 840 series SSD - WOW!!!
    PSU
    Why do we ask this for laptops?
    Case
    Silver with a neat Samsung logo
    Cooling
    sub-par, gotta get around to working on it soon Worked on it - still sub-par! :(
    Keyboard
    Microsoft Natural - the same one I've used since it orignally came out around 1995
    Mouse
    no Mouse - Trackball!!!!
    Internet Speed
    too slow when I'm waiting for a download to finish
    Browser
    Yes, I use this (Firefox mostly, w/IE next most)
    Antivirus
    Windows Defender and Windows Firewall
    Other Info
    I'm handsome and a snappy dresser :0)
You must log in or register to reply here.
Back
Top